Not launch-ready. Outreach must not begin until these are real: account manager name (a real person), legal entity name, postal address (required for commercial email), support phone number, support email on an authenticated domain. Set them in app/brand.py.
STANDARD

Privacy

Privacy

Short, because we collect very little.

This is a draft and is not in force.

A privacy notice has to name the party responsible for the data and a way to contact them. Neither exists yet.

Missing: account manager name (a real person), legal entity name, postal address (required for commercial email), support phone number, support email on an authenticated domain. Have it reviewed before publishing — several US states impose specific obligations on this notice.

If you're a customer

We hold your name, email address, phone number, business address and the public information about your business used to build your website. We keep records of your messages to us and the changes you've asked for.

We do not hold your card details. Payments go through Stripe, who store them. We keep only an identifier that lets us ask Stripe about your subscription.

We do not hold a password for you, because sign-in works by emailed link.

If you visit a website we host

We count page views so the business whose site you're on can see how many people visited. Your IP address is never written to disk. It is combined with a secret value and turned into an irreversible fingerprint, which cannot be turned back into an address or linked to you personally.

We record the page you looked at, the site that sent you (if any), and whether you were on a phone, tablet or computer. That's everything.

There are no advertising cookies, no third-party analytics and no tracking scripts on any site we build — which is why those sites don't need a cookie banner.

If you use a contact form

Your name, contact details and message are stored and passed to the business you contacted. They are that business's to handle from there. We don't use them for anything else and we don't market to you.

Cookies

One, and only if you sign in to your account or we sign in to ours. It keeps you signed in and does nothing else. There are no cookies on customer websites.

Who else is involved

We use a small number of suppliers to run the service, each of whom handles only what they need to:

  • Stripe — payments, cards and invoices.
  • A domain registrar — registering domains in customers' names. Registrant details are published or withheld according to that registrar's privacy service.
  • A hosting provider — the servers the sites run on.
  • An email provider — sign-in links and notifications.

We do not sell personal information, and we do not share it with anyone for their own marketing.

Unsolicited contact

We contact businesses that haven't heard from us, using publicly listed business contact details, to show them a website we've built. Every message says who we are and how to stop hearing from us. Ask us to stop and we will, permanently.

How long we keep things

Customer records are kept while you're a customer and for as long afterwards as we need them for tax and accounting. Analytics are kept for as long as your site is with us. Preview sites for businesses that never became customers are deleted once they're clearly not wanted.

Your rights

Ask us what we hold about you and we'll tell you. Ask us to correct it and we will. Ask us to delete it and we will, except where we're required to keep it. Depending on where you live you may have further rights, and we'll honour those too.

Contact

[Contact details to be added before this notice is published.]

Last updated 2026.